BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

2.1 System BIOS

NIST platform security: roots of trust, firmware and secure enclaves SP 800-147B
All changes in this version
first version loaded 2 Background part of 2

Title

System BIOS

Control

Exclusive of certain configuration and security code that may be embedded into a platform’s silicon components, e.g., processor, the system BIOS is the first software executed on the main central processing unit (CPU) when a computer is powered on. While the system BIOS was originally responsible for providing operating systems access to hardware, its primary role on modern machines is to initialize and test hardware components and load the operating system. In addition, the BIOS loads and initializes important system management functions, such as power and thermal management. The system BIOS may also load CPU microcode patches during the boot process.

There are several different types of BIOS firmware. Some computers use a 16-bit conventional BIOS, while many newer systems use boot firmware based on the UEFI specifications [UEFI], or use other customized boot firmware. In this document we refer to all types of boot firmware as BIOS firmware, the system BIOS, or simply BIOS. When necessary, we differentiate conventional BIOS firmware from UEFI firmware by calling them the conventional BIOS and UEFI BIOS, respectively.

System BIOS is typically developed by the original equipment manufacturer (OEM) of the server. Manufacturers frequently update system firmware to fix bugs, patch vulnerabilities, and support new hardware. The system BIOS is typically stored on electrically erasable programmable read-only memory (EEPROM) or other forms of flash memory. Typically, system BIOS firmware is updated using a utility or tool that has special knowledge of the non-volatile storage components in which the BIOS is stored. This tool may run on one of the CPUs in the server itself, or it could run on a management processor within the server chassis.

A given computer system can have BIOS in several different locations. In addition to the motherboard, BIOS may be found on hard drive controllers, video cards, network cards and other add-in cards. This additional firmware generally takes the form of Option ROMs (containing conventional BIOS and/or UEFI drivers). These are loaded by the system firmware during the boot process and executed on the host CPU. Option ROMs should not be confused with device firmware; there are many system devices in a server with microcontrollers that run their own firmware.

The guidelines in this document apply to BIOS firmware stored in the BIOS flash memory, including the BIOS code, the cryptographic keys that are part of the Root of Trust for Update, and static BIOS data. Option ROMs that are stored with the system BIOS firmware and are updated by the same mechanism are considered part of the BIOS for the purposes of this document. However, the guidelines do not apply to Option ROMs and other device firmware stored elsewhere in a server, such as on an add-on card.

For more information on system BIOS fundamentals, see Section 2 of NIST SP 800-147.